Vulnerability-Lookup

ubuntu-cve-2026-27858

Vulnerability from osv_ubuntu

Published

2026-03-27 00:00

Modified

2026-06-30 16:19

Summary

Details

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-27858	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-27858	REPORT
	https://ubuntu.com/security/notices/USN-8136-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          },
          {
            "binary_name": "mail-stack-delivery",
            "binary_version": "1:2.2.9-1ubuntu2.6+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.2.9-1ubuntu2.6+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.1.7-7ubuntu3",
        "1:2.2.9-1ubuntu1",
        "1:2.2.9-1ubuntu2",
        "1:2.2.9-1ubuntu2.1",
        "1:2.2.9-1ubuntu2.3",
        "1:2.2.9-1ubuntu2.4",
        "1:2.2.9-1ubuntu2.5",
        "1:2.2.9-1ubuntu2.6",
        "1:2.2.9-1ubuntu2.6+esm1",
        "1:2.2.9-1ubuntu2.6+esm2",
        "1:2.2.9-1ubuntu2.6+esm3",
        "1:2.2.9-1ubuntu2.6+esm4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-lucene",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          },
          {
            "binary_name": "mail-stack-delivery",
            "binary_version": "1:2.2.22-1ubuntu2.14"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.2.22-1ubuntu2.14?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.2.18-2ubuntu2",
        "1:2.2.22-1ubuntu1",
        "1:2.2.22-1ubuntu2",
        "1:2.2.22-1ubuntu2.1",
        "1:2.2.22-1ubuntu2.2",
        "1:2.2.22-1ubuntu2.3",
        "1:2.2.22-1ubuntu2.4",
        "1:2.2.22-1ubuntu2.6",
        "1:2.2.22-1ubuntu2.7",
        "1:2.2.22-1ubuntu2.8",
        "1:2.2.22-1ubuntu2.9",
        "1:2.2.22-1ubuntu2.10",
        "1:2.2.22-1ubuntu2.11",
        "1:2.2.22-1ubuntu2.12",
        "1:2.2.22-1ubuntu2.13",
        "1:2.2.22-1ubuntu2.14"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          },
          {
            "binary_name": "mail-stack-delivery",
            "binary_version": "1:2.2.33.2-1ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.2.33.2-1ubuntu4.8?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.2.27-3ubuntu1",
        "1:2.2.33.2-1ubuntu1",
        "1:2.2.33.2-1ubuntu2",
        "1:2.2.33.2-1ubuntu3",
        "1:2.2.33.2-1ubuntu4",
        "1:2.2.33.2-1ubuntu4.1",
        "1:2.2.33.2-1ubuntu4.2",
        "1:2.2.33.2-1ubuntu4.3",
        "1:2.2.33.2-1ubuntu4.4",
        "1:2.2.33.2-1ubuntu4.5",
        "1:2.2.33.2-1ubuntu4.6",
        "1:2.2.33.2-1ubuntu4.7",
        "1:2.2.33.2-1ubuntu4.8"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "dovecot-auth-lua",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-lucene",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "dovecot-submissiond",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          },
          {
            "binary_name": "mail-stack-delivery",
            "binary_version": "1:2.3.7.2-1ubuntu3.7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.3.7.2-1ubuntu3.7?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3.4.1-5ubuntu3",
        "1:2.3.7.2-1ubuntu1",
        "1:2.3.7.2-1ubuntu2",
        "1:2.3.7.2-1ubuntu3",
        "1:2.3.7.2-1ubuntu3.1",
        "1:2.3.7.2-1ubuntu3.2",
        "1:2.3.7.2-1ubuntu3.3",
        "1:2.3.7.2-1ubuntu3.4",
        "1:2.3.7.2-1ubuntu3.5",
        "1:2.3.7.2-1ubuntu3.6",
        "1:2.3.7.2-1ubuntu3.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "dovecot-auth-lua",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-lucene",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-submissiond",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.3.16+dfsg1-3ubuntu2.7?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.3.16+dfsg1-3ubuntu2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3.13+dfsg1-1ubuntu3",
        "1:2.3.16+dfsg1-3ubuntu1",
        "1:2.3.16+dfsg1-3ubuntu2",
        "1:2.3.16+dfsg1-3ubuntu2.1",
        "1:2.3.16+dfsg1-3ubuntu2.2",
        "1:2.3.16+dfsg1-3ubuntu2.4",
        "1:2.3.16+dfsg1-3ubuntu2.6"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "dovecot-auth-lua",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-submissiond",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.3.21+dfsg1-2ubuntu6.3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.3.21+dfsg1-2ubuntu6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3.20+dfsg1-1ubuntu3",
        "1:2.3.21+dfsg1-2ubuntu1",
        "1:2.3.21+dfsg1-2ubuntu2",
        "1:2.3.21+dfsg1-2ubuntu4",
        "1:2.3.21+dfsg1-2ubuntu5",
        "1:2.3.21+dfsg1-2ubuntu6",
        "1:2.3.21+dfsg1-2ubuntu6.1",
        "1:2.3.21+dfsg1-2ubuntu6.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "dovecot-auth-lua",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-flatcurve",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-submissiond",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.4.1+dfsg1-5ubuntu4.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.1+dfsg1-5ubuntu4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3.21.1+dfsg1-1ubuntu2",
        "1:2.4.1+dfsg1-5ubuntu1",
        "1:2.4.1+dfsg1-5ubuntu3",
        "1:2.4.1+dfsg1-5ubuntu4"
      ]
    }
  ],
  "aliases": [],
  "details": "Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.  Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.",
  "id": "UBUNTU-CVE-2026-27858",
  "modified": "2026-06-30T16:19:40Z",
  "published": "2026-03-27T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-27858"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27858"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8136-1"
    }
  ],
  "related": [
    "USN-8136-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-27858"
  ]
}

CVE-2026-27858 (GCVE-0-2026-27858)

Vulnerability from cvelistv5 – Published: 2026-03-27 08:10 – Updated: 2026-07-15 01:12

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

References

18 references

URL	Tags
https://documentation.open-xchange.com/dovecot/se…	vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-27858	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2452175	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:26564	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17602	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13498	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19149	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13830	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19455	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19453	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:18053	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17630	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17628	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17625	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17626	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13857	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19364	vendor-advisoryx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
Open-Xchange GmbH	OX Dovecot Pro	Affected: 0 , ≤ 2.3.0 (semver) Affected: 0 , ≤ 3.1.0 (semver) Affected: 0 , ≤ 2.4.0 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:2.3.21-16.el10_1.1 , < * (rpm) Unaffected: 1:2.3.21-19.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:2.3.21-16.el10_0.1 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 1:2.2.36-8.el7_9.1 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 1:2.3.16-7.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 1:2.3.8-9.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 1:2.3.8-9.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 1:2.3.16-2.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 1:2.3.16-2.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 1:2.3.16-2.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 1:2.3.16-3.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 1:2.3.16-3.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:2.3.16-15.el9_7.1 , < * (rpm) Unaffected: 1:2.3.16-18.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 1:2.3.16-3.el9_0.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 1:2.3.16-8.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 1:2.3.16-11.el9_4.2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 1:2.3.16-15.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T12:36:26.526829Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T12:37:09.762Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1",
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.21-16.el10_1.1",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.21-19.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.21-16.el10_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.2.36-8.el7_9.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-7.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.8-9.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.8-9.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-2.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-2.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-2.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-3.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-3.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-15.el9_7.1",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-18.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-3.el9_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-8.el9_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-11.el9_4.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:2.3.16-15.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "affected",
            "packageName": "dovecot",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-03-27T08:10:21.424Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in dovecot. An unauthenticated and remote attacker can send a crafted message that causes managesieve to allocate an excessive amount of memory, forcing managesieve-login to be unavailable by repeatedly crashing the process, resulting in a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:12:45.177Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-27858"
          },
          {
            "name": "RHBZ#2452175",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452175"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27858.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26564"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17602"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13498"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19149"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13830"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19455"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19453"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:18053"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17630"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17628"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17625"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17626"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13857"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19364"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:26564: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17602: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13498: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19149: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13830: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19455: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19453: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:18053: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17630: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17628: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17625: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17626: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13857: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19364: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-27T09:01:45.192Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-03-27T08:10:21.424Z",
            "value": "Made public."
          }
        ],
        "title": "dovecot: denial of service via crafted message before authentication",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, protect access to the managesieve protocol by configuring firewall rules to restrict access to the managesieve port and only allow connections from trusted IP addresses or networks."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "core"
          ],
          "product": "OX Dovecot Pro",
          "vendor": "Open-Xchange GmbH",
          "versions": [
            {
              "lessThanOrEqual": "2.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.\r\n Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T12:33:31.126Z",
        "orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
        "shortName": "OX"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json"
        }
      ],
      "source": {
        "defect": "DOV-8818",
        "discovery": "EXTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
    "assignerShortName": "OX",
    "cveId": "CVE-2026-27858",
    "datePublished": "2026-03-27T08:10:21.424Z",
    "dateReserved": "2026-02-24T08:46:09.374Z",
    "dateUpdated": "2026-07-15T01:12:45.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-8136-1

Vulnerability from osv_ubuntu

Published

2026-03-31 09:48

Modified

2026-06-30 15:54

Summary

dovecot vulnerabilities

Details

It was discovered that Dovecot incorrectly handled invalid base64 SASL data. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10. (CVE-2025-59028)

It was discovered that Dovecot script decode2text.sh incorrectly handled zip files. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-59031)

It was discovered that Dovecot incorrectly handled certain AUTHENTICATE requests. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-59032)

It was discovered that Dovecot incorrectly handled certain SQL based authentication. An attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 25.10. (CVE-2026-24031)

It was discovered that Dovecot incorrectly handled certain LDAP based authentication. An attacker could possibly use this issue to bypass restrictions and allow probing of LDAP structure. This issue only affected Ubuntu 25.10. (CVE-2026-27860)

It was discovered that Dovecot is vulnerable to replay attack under certain conditions. An attacker could possibly use this issue to bypass authentication. (CVE-2026-27855)

It was discovered that Dovecot is vulnerable to a timing attack under certain conditions. An attacker could possibly use this issue to bypass authentication. (CVE-2026-27856)

It was discovered that Dovecot incorrectly handled certain IMAP login requests. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-27857)

It was discovered that Dovecot incorrectly handled certain specially crafted messages. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-27858)

It was discovered that Dovecot incorrectly handled certain specially crafted mail messages. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-27859)

It was discovered that Dovecot incorrectly handles file paths. A attacker could possibly use this issue to perform a path traversal and obtain or modify arbitrary files. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-0394)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8136-1	ADVISORY
	https://ubuntu.com/security/CVE-2025-59028	REPORT
	https://ubuntu.com/security/CVE-2025-59031	REPORT
	https://ubuntu.com/security/CVE-2025-59032	REPORT
	https://ubuntu.com/security/CVE-2026-0394	REPORT
	https://ubuntu.com/security/CVE-2026-24031	REPORT
	https://ubuntu.com/security/CVE-2026-27855	REPORT
	https://ubuntu.com/security/CVE-2026-27856	REPORT
	https://ubuntu.com/security/CVE-2026-27857	REPORT
	https://ubuntu.com/security/CVE-2026-27858	REPORT
	https://ubuntu.com/security/CVE-2026-27859	REPORT
	https://ubuntu.com/security/CVE-2026-27860	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-59031",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-59032",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-0394",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27855",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27856",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27857",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27858",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27859",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "dovecot-auth-lua",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-lucene",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          },
          {
            "binary_name": "dovecot-submissiond",
            "binary_version": "1:2.3.16+dfsg1-3ubuntu2.7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.3.16+dfsg1-3ubuntu2.7?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.3.16+dfsg1-3ubuntu2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3.13+dfsg1-1ubuntu3",
        "1:2.3.16+dfsg1-3ubuntu1",
        "1:2.3.16+dfsg1-3ubuntu2",
        "1:2.3.16+dfsg1-3ubuntu2.1",
        "1:2.3.16+dfsg1-3ubuntu2.2",
        "1:2.3.16+dfsg1-3ubuntu2.4",
        "1:2.3.16+dfsg1-3ubuntu2.6"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-59031",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-59032",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-0394",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27855",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27856",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27857",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27858",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27859",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "dovecot-auth-lua",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          },
          {
            "binary_name": "dovecot-submissiond",
            "binary_version": "1:2.3.21+dfsg1-2ubuntu6.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.3.21+dfsg1-2ubuntu6.3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.3.21+dfsg1-2ubuntu6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3.20+dfsg1-1ubuntu3",
        "1:2.3.21+dfsg1-2ubuntu1",
        "1:2.3.21+dfsg1-2ubuntu2",
        "1:2.3.21+dfsg1-2ubuntu4",
        "1:2.3.21+dfsg1-2ubuntu5",
        "1:2.3.21+dfsg1-2ubuntu6",
        "1:2.3.21+dfsg1-2ubuntu6.1",
        "1:2.3.21+dfsg1-2ubuntu6.2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-59028",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-59031",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-59032",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-24031",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27855",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27856",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27857",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27858",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27859",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-27860",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:25.10"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "dovecot-auth-lua",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-core",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-flatcurve",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-gssapi",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-imapd",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-ldap",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-lmtpd",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-managesieved",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-mysql",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-pgsql",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-pop3d",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-sieve",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-solr",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-sqlite",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          },
          {
            "binary_name": "dovecot-submissiond",
            "binary_version": "1:2.4.1+dfsg1-5ubuntu4.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "dovecot",
        "purl": "pkg:deb/ubuntu/dovecot@1:2.4.1+dfsg1-5ubuntu4.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:2.4.1+dfsg1-5ubuntu4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:2.3.21.1+dfsg1-1ubuntu2",
        "1:2.4.1+dfsg1-5ubuntu1",
        "1:2.4.1+dfsg1-5ubuntu3",
        "1:2.4.1+dfsg1-5ubuntu4"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Dovecot incorrectly handled invalid base64 SASL data.\nAn attacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 25.10. (CVE-2025-59028)\n\nIt was discovered that Dovecot script decode2text.sh incorrectly handled zip\nfiles. An attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2025-59031)\n\nIt was discovered that Dovecot incorrectly handled certain AUTHENTICATE\nrequests. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2025-59032)\n\nIt was discovered that Dovecot incorrectly handled certain SQL based\nauthentication. An attacker could possibly use this issue to bypass\nauthentication. This issue only affected Ubuntu 25.10. (CVE-2026-24031)\n\nIt was discovered that Dovecot incorrectly handled certain LDAP based\nauthentication. An attacker could possibly use this issue to bypass\nrestrictions and allow probing of LDAP structure. This issue only affected\nUbuntu 25.10. (CVE-2026-27860)\n\nIt was discovered that Dovecot is vulnerable to replay attack under\ncertain conditions. An attacker could possibly use this issue to bypass\nauthentication. (CVE-2026-27855)\n\nIt was discovered that Dovecot is vulnerable to a timing attack under\ncertain conditions. An attacker could possibly use this issue to bypass\nauthentication. (CVE-2026-27856)\n\nIt was discovered that Dovecot incorrectly handled certain IMAP login\nrequests. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-27857)\n\nIt was discovered that Dovecot incorrectly handled certain specially\ncrafted messages. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-27858)\n\nIt was discovered that Dovecot incorrectly handled certain specially\ncrafted mail messages. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2026-27859)\n\nIt was discovered that Dovecot incorrectly handles file paths. A attacker\ncould possibly use this issue to perform a path traversal and obtain or\nmodify arbitrary files. This issue only affected Ubuntu 22.04 LTS and\nUbuntu 24.04 LTS. (CVE-2026-0394)",
  "id": "USN-8136-1",
  "modified": "2026-06-30T15:54:54Z",
  "published": "2026-03-31T09:48:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8136-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-59028"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-59031"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-59032"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-0394"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-24031"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-27855"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-27856"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-27857"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-27858"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-27859"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-27860"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "dovecot vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2025-59028",
    "UBUNTU-CVE-2025-59031",
    "UBUNTU-CVE-2025-59032",
    "UBUNTU-CVE-2026-0394",
    "UBUNTU-CVE-2026-24031",
    "UBUNTU-CVE-2026-27855",
    "UBUNTU-CVE-2026-27856",
    "UBUNTU-CVE-2026-27857",
    "UBUNTU-CVE-2026-27858",
    "UBUNTU-CVE-2026-27859",
    "UBUNTU-CVE-2026-27860"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2026-27858

Vulnerability from osv_ubuntu

CVE-2026-27858 (GCVE-0-2026-27858)

usn-8136-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature